T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:48
- Finding
- API Server Binds to All Network Interfaces Without Documented Access Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48-51 **Vulnerability Type**: Externally reachable service with insufficiently documented access controls **Risk Level**: Medium ### Vulnerable Code ```bash **Native API Server:** ```bash python tools/api_server.py --llama-checkpoint-path checkpoints/s2-pro --decoder-checkpoint-path checkpoints/s2-pro/codec.pth --listen 0.0.0.0:8080 ``` ``` ### Technical Analysis The deployment command binds the native API server to `0.0.0.0`, making it reachable through every available network interface rather than limiting it to the local host. The Skill does not instruct the operator to enable authentication, authorization, TLS, request throttling, or network filtering. The documented API includes speech generation and voice-management operations. In particular, `references/api-reference.md` documents voice-sample upload, deletion, and persistent storage under `~/.cache/vllm-omni/speakers/`. If the native server exposes these operations without additional access controls, an unauthenticated network client could invoke sensitive or resource-intensive functionality. Binding to every interface is not required for the minimum declared local TTS functionality. A loopback binding would be sufficient for the examples that send requests to `localhost`. ### Attack Path 1. An operator starts the server using the documented command. 2. The process listens on port 8080 across all network interfaces. 3. An attacker with network access to the host discovers the exposed service. 4. The attacker submits repeated synthesis requests to consume GPU, CPU, and memory resources. 5. If the documented voice-management endpoints are available without authorization, the attacker uploads unauthorized voice samples or modifies/deletes stored voice profiles. 6. Generated output or stored biometric voice data may consequently be exposed to unauthorized parties, depending on the server implementation and surrounding infrastruct ...[truncated 697 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind to the loopback interface by default: ```bash python tools/api_server.py \ --llama-checkpoint-path checkpoints/s2-pro \ --decoder-checkpoint-path checkpoints/s2-pro/codec.pth \ --listen 127.0.0.1:8080 ``` 2. If remote access is necessary, place the service behind an authenticated reverse proxy and require TLS. 3. Enforce authorization separately for synthesis, voice upload, voice deletion, and voice enumeration. 4. Configure host and network firewalls so only explicitly trusted clients can reach the service. 5. Add request-size, batch-size, concurrency, generation-token, and rate limits. 6. Avoid logging request text, transcripts, reference audio, authentication headers, or generated biometric data. 7. Document retention and deletion controls for stored voice profiles. 8. Clearly warn operators that binding to `0.0.0.0` creates network exposure and should be an explicit opt-in configuration. ]]>